Class PolicyCheckerImpl
java.lang.Object
org.elasticsearch.entitlement.runtime.policy.PolicyCheckerImpl
- All Implemented Interfaces:
PolicyChecker
Connects the
PolicyChecker interface to a PolicyManager
to perform the checks in accordance with the policy.
Determines the caller class, queries PolicyManager
to find what entitlements have been granted to that class,
and finally checks whether the desired entitlements are present.-
Field Summary
FieldsModifier and TypeFieldDescriptionprotected final ModuleFrames originating from this module are ignored in the permission logic. -
Constructor Summary
ConstructorsConstructorDescriptionPolicyCheckerImpl(Set<Package> suppressFailureLogPackages, Module entitlementsModule, PolicyManager policyManager, PathLookup pathLookup) -
Method Summary
Modifier and TypeMethodDescriptionvoidcheckAllNetworkAccess(Class<?> callerClass) voidcheckChangeFilesHandling(Class<?> callerClass) Check for operations that can modify the way file operations are handledvoidcheckChangeJVMGlobalState(Class<?> callerClass) voidcheckChangeNetworkHandling(Class<?> callerClass) Check for operations that can modify the way network operations are handledvoidcheckCreateClassLoader(Class<?> callerClass) voidcheckCreateTempFile(Class<?> callerClass) voidcheckEntitlementForUrl(Class<?> callerClass, URL url) voidcheckEntitlementForURLConnection(Class<?> callerClass, URLConnection urlConnection) voidcheckEntitlementPresent(Class<?> callerClass, Class<? extends Entitlement> entitlementClass) voidcheckExitVM(Class<?> callerClass) voidcheckFileDescriptorRead(Class<?> callerClass) voidcheckFileDescriptorWrite(Class<?> callerClass) voidcheckFileRead(Class<?> callerClass, File file) voidcheckFileRead(Class<?> callerClass, Path path) voidcheckFileRead(Class<?> callerClass, Path path, boolean followLinks) voidcheckFileWithZipMode(Class<?> callerClass, File file, int zipMode) voidcheckFileWrite(Class<?> callerClass, File file) voidcheckFileWrite(Class<?> callerClass, Path path) voidcheckGetFileAttributeView(Class<?> callerClass) Invoked when we try to get an arbitraryFileAttributeViewclass.voidcheckInboundNetworkAccess(Class<?> callerClass) voidcheckJarURLAccess(Class<?> callerClass, JarURLConnection connection) voidcheckLoadingNativeLibraries(Class<?> callerClass) Check for operations that can access sensitive network information, e.g.voidcheckLoggingFileHandler(Class<?> callerClass) voidcheckManageThreadsEntitlement(Class<?> callerClass) voidcheckOutboundNetworkAccess(Class<?> callerClass) voidcheckReadStoreAttributes(Class<?> callerClass) voidcheckSetHttpsConnectionProperties(Class<?> callerClass) voidcheckStartProcess(Class<?> callerClass) voidcheckUnsupportedURLProtocolConnection(Class<?> callerClass, String protocol) voidcheckURLFileRead(Class<?> callerClass, URL url) voidcheckWriteProperty(Class<?> callerClass, String property) voidcheckWriteStoreAttributes(Class<?> callerClass)
-
Field Details
-
suppressFailureLogPackages
-
entitlementsModule
Frames originating from this module are ignored in the permission logic.
-
-
Constructor Details
-
PolicyCheckerImpl
public PolicyCheckerImpl(Set<Package> suppressFailureLogPackages, Module entitlementsModule, PolicyManager policyManager, PathLookup pathLookup)
-
-
Method Details
-
checkStartProcess
- Specified by:
checkStartProcessin interfacePolicyChecker
-
checkWriteStoreAttributes
- Specified by:
checkWriteStoreAttributesin interfacePolicyChecker
-
checkReadStoreAttributes
- Specified by:
checkReadStoreAttributesin interfacePolicyChecker
-
checkExitVM
- Specified by:
checkExitVMin interfacePolicyChecker
-
checkCreateClassLoader
- Specified by:
checkCreateClassLoaderin interfacePolicyChecker
-
checkSetHttpsConnectionProperties
- Specified by:
checkSetHttpsConnectionPropertiesin interfacePolicyChecker
-
checkChangeJVMGlobalState
- Specified by:
checkChangeJVMGlobalStatein interfacePolicyChecker
-
checkLoggingFileHandler
- Specified by:
checkLoggingFileHandlerin interfacePolicyChecker
-
checkChangeNetworkHandling
Check for operations that can modify the way network operations are handled- Specified by:
checkChangeNetworkHandlingin interfacePolicyChecker
-
checkChangeFilesHandling
Check for operations that can modify the way file operations are handled- Specified by:
checkChangeFilesHandlingin interfacePolicyChecker
-
checkFileRead
- Specified by:
checkFileReadin interfacePolicyChecker
-
checkFileRead
- Specified by:
checkFileReadin interfacePolicyChecker
-
checkFileRead
public void checkFileRead(Class<?> callerClass, Path path, boolean followLinks) throws NoSuchFileException - Specified by:
checkFileReadin interfacePolicyChecker- Throws:
NoSuchFileException
-
checkFileWrite
- Specified by:
checkFileWritein interfacePolicyChecker
-
checkFileWrite
- Specified by:
checkFileWritein interfacePolicyChecker
-
checkFileWithZipMode
- Specified by:
checkFileWithZipModein interfacePolicyChecker
-
checkCreateTempFile
- Specified by:
checkCreateTempFilein interfacePolicyChecker
-
checkFileDescriptorRead
- Specified by:
checkFileDescriptorReadin interfacePolicyChecker
-
checkFileDescriptorWrite
- Specified by:
checkFileDescriptorWritein interfacePolicyChecker
-
checkGetFileAttributeView
Invoked when we try to get an arbitraryFileAttributeViewclass. Such a class can modify attributes, like owner etc.; we could think about introducing checks for each of the operations, but for now we over-approximate this and simply deny when it is used directly.- Specified by:
checkGetFileAttributeViewin interfacePolicyChecker
-
checkLoadingNativeLibraries
Check for operations that can access sensitive network information, e.g. secrets, tokens or SSL sessions- Specified by:
checkLoadingNativeLibrariesin interfacePolicyChecker
-
checkInboundNetworkAccess
- Specified by:
checkInboundNetworkAccessin interfacePolicyChecker
-
checkOutboundNetworkAccess
- Specified by:
checkOutboundNetworkAccessin interfacePolicyChecker
-
checkAllNetworkAccess
- Specified by:
checkAllNetworkAccessin interfacePolicyChecker
-
checkUnsupportedURLProtocolConnection
- Specified by:
checkUnsupportedURLProtocolConnectionin interfacePolicyChecker
-
checkWriteProperty
- Specified by:
checkWritePropertyin interfacePolicyChecker
-
checkManageThreadsEntitlement
- Specified by:
checkManageThreadsEntitlementin interfacePolicyChecker
-
checkEntitlementPresent
public void checkEntitlementPresent(Class<?> callerClass, Class<? extends Entitlement> entitlementClass) - Specified by:
checkEntitlementPresentin interfacePolicyChecker
-
checkEntitlementForUrl
- Specified by:
checkEntitlementForUrlin interfacePolicyChecker
-
checkEntitlementForURLConnection
- Specified by:
checkEntitlementForURLConnectionin interfacePolicyChecker
-
checkJarURLAccess
- Specified by:
checkJarURLAccessin interfacePolicyChecker
-
checkURLFileRead
- Specified by:
checkURLFileReadin interfacePolicyChecker
-